Write a missing signing request and give up on a handshake that never returns.

A certificate already on disk still has to be renewable, and a reflector that never finishes TLS must not hold the session past the login timers.

Co-authored-by: Cursor <cursoragent@cursor.com>

station/reflector_test.go

@@ -148,15 +148,25 @@ func (r *reflector) conn() net.Conn {
 
 func newReflector(t *testing.T) *reflector {
 	t.Helper()
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	port := ln.Addr().(*net.TCPAddr).Port
-	udp, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: port})
-	if err != nil {
+	var ln net.Listener
+	var udp *net.UDPConn
+	var port int
+	for range 8 {
+		var err error
+		ln, err = net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			t.Fatal(err)
+		}
+		port = ln.Addr().(*net.TCPAddr).Port
+		udp, err = net.ListenUDP("udp", &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: port})
+		if err == nil {
+			break
+		}
 		ln.Close()
-		t.Fatal(err)
+		ln = nil
+	}
+	if udp == nil {
+		t.Fatal("udp port stayed in use")
 	}
 	t.Cleanup(func() {
 		if ln != nil {